Malware 2
5 Lecture 27.nov.2015
Course information and communication
3 Things last week ?
My 5 cents
My 5 cents
My 5 cents
My 5 cents
My 5 cents
My 5 cents
My 5 cents
My 5 cents
Today's Plan
Dark Seoul analysis overview
We Will go over toolset:
Dark Seoul
Modus operandi:
Break in to the website and trojanise legitime video codec
By doing this, they were able to target organizations that relied on the distributor’s security camera solution and infect their systems
Current attack is against european transport company .
Dark Seoul Stage 1
Dark Seoul Stage 1
Dark Seoul Stage 1
Dark Seoul Stage 2
Dark Seoul Stage 2
In total, the following 14 functions are loaded during runtime:
Dark Seoul Stage 3 ( act as a downloader. )
hxxp://www.combra[.]eu/includes/images/logo.jpg
Dark Seoul Stage 3 ( act as a downloader. )
Dark Seoul Stage 3 ( act as a downloader. )
Downloaded file is dropped to folder System32 and named after random dll
example > you have apcups.dll then apcups.exe is created.
Dark Seoul Stage 3 ( act as a downloader. )
Downloaded file is dropped to folder System32 and named after random dll
example > you have apcups.dll then apcups.exe is created.
Dark Seoul Stage 4 New executable
file begins by checking the parent process for the
presence of ‘cmd.exe’ or ‘explorer.exe’.
It proceeds to randomly select an executable file
in the system32 folder,
and performs process hollowing against it.
Dark Seoul Final payload Stage 5
Deobfuscates strings (string obfuscation method in picture implemented in Python)
Loads additional libraries determines if process V3lite.exe is running
Dark Seoul Final payload Stage 5
Global\SPPLMUTEX < To control that only one version is running
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Dark Seoul Final payload Stage 5
Information Collected:
Victim ID generation :
HKCU\SOFTWARE\Microsoft\HY08A\Build < ID is stored here
Dark Seoul Final payload Stage 5
C&C URL -s
Dark Seoul C&C response
Dark Seoul C&C response
Key generation algorithm
Decryption algorithm
known implementations in python available
The malware will store these command identifiers in the following files:
tick 7880
systeminfo & net view & netstat -naop tcp & tasklist & dir /a "%userprofile%\AppData\Local\Microsoft\Outlook" & dir /a "%temp%\*.exe" & dir "%ProgramFiles%" & dir "%ProgramFiles%\Microsoft Office"
1018; 60
Dark Seoul C&C response
1001 Modify C2 URLs
1003 Download
1013 Download/execute malware in other process
1018 Modify wait interval time
1025 Download/execute and return response
Default Execute command and return results
Dark Seoul response to C&C
Dark Seoul modification in system
HKCU\Software\Microsoft\HY08A\Policy
Additionally, in the event the C2 response instructs the malware to update C2 URLs, it will be in the following format:
1001; [unique_identifier] [url]
The malware will encrypt the URL string with a 4-byte XOR key of “\x01\x02\x03\x04” and store this data in the following registry key:
HKCU\Software\Microsoft\HY08A\[unique_identifier]
Tools
Can be divided
Detection and Classification
Detection and Classification
Detection and Classification
Browser Malware handling
Documents and Shellcode
Documents and Shellcode
File Carving
Debugging and Reverse Engineering
Debugging and Reverse Engineering
Debugging and Reverse Engineering
Network
Network
Memory Forensics
Memory Forensics
Windows Artifacts
Storage and Workflow
.…
https://github.com/rshipp/awesome-malware-analysis
Where to get binarys too start with:
http://www.binary-auditing.com/
http://www.bright-shadows.net/